Skip to content

CBOM: add custom fingerprints#903

Open
bhess wants to merge 1 commit intoCycloneDX:2.0-devfrom
bhess:bhe-20-fingerprint
Open

CBOM: add custom fingerprints#903
bhess wants to merge 1 commit intoCycloneDX:2.0-devfrom
bhess:bhe-20-fingerprint

Conversation

@bhess
Copy link
Copy Markdown
Contributor

@bhess bhess commented Apr 2, 2026

Extend the fingerprint definition in cyclonedx-cryptography-2.0.schema.json to support custom fingerprint algorithms alongside standard hash algorithms.

Changes

  • Replace the flat $ref: hash on certificateProperties.fingerprint and relatedCryptoMaterialProperties.fingerprint with a single central $defs/fingerprint definition
  • $defs/fingerprint uses oneOf with two branches:
    • Standard Hashalg + content (refs to existing hashAlgorithm / hashValue); fully backward compatible
    • Custom FingerprintcustomAlg + customContent for non-standard algorithms

Backward Compatibility

Existing documents with {"alg": "SHA-256", "content": "..."} satisfy the Standard Hash branch unchanged.

Signed-off-by: Basil Hess <bhe@zurich.ibm.com>
@bhess bhess requested a review from a team as a code owner April 2, 2026 15:23
@bhess bhess added the cap: cryptography Capability: Cryptography (CBOM) label Apr 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cap: cryptography Capability: Cryptography (CBOM)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant